@critical-path/core 0.27.0 → 0.29.0

package/src/domain/custom-fields.ts

@@ -1,4 +1,5 @@
-import type { CustomFieldDefinition } from '../types/index.js';
+import type { CustomFieldDefinition, CustomFieldType } from '../types/index.js';
+import { BUILT_IN_CUSTOM_FIELD_TYPES } from '../plugins/index.js';
 
 export class CustomFieldValidationError extends Error {
   public readonly fieldKey: string;
@@ -16,7 +17,8 @@ export class CustomFieldValidationError extends Error {
 
 export function validateCustomFieldValues(
   definitions: CustomFieldDefinition[] | undefined,
-  values: Record<string, unknown> | undefined
+  values: Record<string, unknown> | undefined,
+  customTypes?: ReadonlyMap<string, CustomFieldType>
 ): void {
   if (!definitions || definitions.length === 0) return;
   const customValues = values || {};
@@ -126,6 +128,45 @@ export function validateCustomFieldValues(
           }
         }
         break;
+      default: {
+        const custom = customTypes?.get(def.type);
+        if (!custom) {
+          throw new CustomFieldValidationError(
+            `Custom field "${def.label || def.key}" has unknown type "${def.type}". Register it with a plugin's customFieldTypes.`,
+            def.key,
+            def.type,
+            value
+          );
+        }
+        const problem = custom.validate(value, def);
+        if (problem) {
+          throw new CustomFieldValidationError(
+            `Custom field "${def.label || def.key}" ${problem}`,
+            def.key,
+            def.type,
+            value
+          );
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Checks that every definition uses a built-in type or one registered by a plugin, so projects
+ * cannot be configured with fields that would reject every value.
+ */
+export function validateCustomFieldDefinitions(
+  definitions: CustomFieldDefinition[] | undefined,
+  customTypes?: ReadonlyMap<string, CustomFieldType>
+): void {
+  for (const def of definitions ?? []) {
+    if (!(BUILT_IN_CUSTOM_FIELD_TYPES as readonly string[]).includes(def.type) && !customTypes?.has(def.type)) {
+      throw new CustomFieldValidationError(
+        `Custom field "${def.label || def.key}" has unknown type "${def.type}". Register it with a plugin's customFieldTypes.`,
+        def.key,
+        def.type
+      );
     }
   }
 }

package/src/domain/events.ts

@@ -124,6 +124,11 @@ export interface TaskDependencyAddedEvent extends DomainEvent<{ dependency: Task
   readonly aggregateType: 'Dependency';
 }
 
+export interface TaskDependencyRemovedEvent extends DomainEvent<{ dependency: TaskDependency }> {
+  readonly name: 'dependency.removed';
+  readonly aggregateType: 'Dependency';
+}
+
 export interface ProjectCreatedEvent extends DomainEvent<{ project: Project }> {
   readonly name: 'project.created';
   readonly aggregateType: 'Project';
@@ -210,6 +215,7 @@ export type CriticalPathDomainEvent =
   | AttachmentCreatedEvent
   | AttachmentDeletedEvent
   | TaskDependencyAddedEvent
+  | TaskDependencyRemovedEvent
   | ProjectCreatedEvent
   | ProjectUpdatedEvent
   | ProjectDeletedEvent
@@ -288,6 +294,7 @@ export const DOMAIN_EVENT_NAMES = [
   'deliverable.status_changed',
   'deliverable.updated',
   'dependency.added',
+  'dependency.removed',
   'iteration.completed',
   'iteration.started',
   'project.created',

package/src/engine/cascade.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect } from 'vitest';
+import {
+  CriticalPathEngine,
+  InMemoryStore,
+  SQLiteStore,
+  FirebaseStore,
+  InMemoryFirestoreMock,
+  InMemoryFileStore,
+  createRolePolicy,
+  ForbiddenError,
+  type StorageAdapter
+} from '../index.js';
+
+const stores: Array<[string, () => StorageAdapter]> = [
+  ['InMemoryStore', () => new InMemoryStore()],
+  ['SQLiteStore', () => new SQLiteStore({ filename: ':memory:' })],
+  ['FirebaseStore', () => new FirebaseStore({ db: new InMemoryFirestoreMock() })]
+];
+
+describe.each(stores)('cascading deletes (%s)', (_name, makeStore) => {
+  async function setup() {
+    const fileStorage = new InMemoryFileStore();
+    const engine = new CriticalPathEngine({ store: makeStore(), fileStorage });
+    const project = await engine.createProject({ name: 'Cascade' });
+    const parent = await engine.createTask({ projectId: project.id, title: 'Parent' });
+    const child = await engine.createTask({ projectId: project.id, title: 'Child', parentId: parent.id });
+    const grandchild = await engine.createTask({ projectId: project.id, title: 'Grandchild', parentId: child.id });
+    const other = await engine.createTask({ projectId: project.id, title: 'Other' });
+    return { engine, fileStorage, project, parent, child, grandchild, other };
+  }
+
+  it('removes subtasks, dependencies, comments, attachments with files, and time entries', async () => {
+    const { engine, fileStorage, parent, child, grandchild, other } = await setup();
+    const dependency = await engine.addDependency({ taskId: other.id, dependsOnTaskId: parent.id, type: 'blocking' });
+    const comment = await engine.addComment({ taskId: parent.id, content: 'note', authorId: 'u1' });
+    const upload = await engine.uploadAttachmentFile({ taskId: parent.id, filename: 'spec.txt', data: 'hello', uploaderId: 'u1' });
+    const onComment = await engine.createAttachment({ commentId: comment.id, filename: 'c.png', url: 'https://example.com/c.png', uploaderId: 'u1', mimeType: 'image/png', sizeBytes: 1 });
+    const entry = await engine.logTime({ taskId: parent.id, hours: 2 });
+
+    expect(await engine.deleteTask(parent.id)).toBe(true);
+
+    for (const id of [parent.id, child.id, grandchild.id]) expect(await engine.getTask(id)).toBeNull();
+    expect(await engine.getTask(other.id)).not.toBeNull();
+    expect(await engine.store.getDependency(dependency.id)).toBeNull();
+    expect(await engine.store.getComment(comment.id)).toBeNull();
+    expect(await engine.store.getAttachment(upload.id)).toBeNull();
+    expect(await engine.store.getAttachment(onComment.id)).toBeNull();
+    expect(await fileStorage.download!(upload.storageKey!).catch(() => null)).toBeNull();
+    expect((await engine.store.getTimeEntries(parent.id)).map((e) => e.id)).not.toContain(entry.id);
+  });
+
+  it('can detach subtasks instead of deleting them', async () => {
+    const { engine, parent, child } = await setup();
+    await engine.deleteTask(parent.id, { subtasks: 'detach' });
+    const kept = await engine.getTask(child.id);
+    expect(kept).not.toBeNull();
+    expect(kept?.parentId).toBeUndefined();
+  });
+
+  it('deletes a project with all its planning records and reports every deleted task', async () => {
+    const { engine, project, parent, child, grandchild, other } = await setup();
+    const container = await engine.createContainer({ projectId: project.id, name: 'Epic' });
+    const iteration = await engine.createIteration({ projectId: project.id, name: 'S1', status: 'planning' });
+    const deliverable = await engine.createDeliverable({ projectId: project.id, title: 'Cut' });
+    const projectFile = await engine.createAttachment({ projectId: project.id, filename: 'brief.pdf', url: 'https://example.com/b.pdf', uploaderId: 'u1', mimeType: 'application/pdf', sizeBytes: 1 });
+
+    let deletedTaskIds: string[] = [];
+    engine.events.subscribe('project.deleted', (e) => {
+      deletedTaskIds = (e.payload as { deletedTaskIds: string[] }).deletedTaskIds;
+    });
+    expect(await engine.deleteProject(project.id)).toBe(true);
+
+    expect(deletedTaskIds.sort()).toEqual([parent.id, child.id, grandchild.id, other.id].sort());
+    expect(await engine.store.getContainer(container.id)).toBeNull();
+    expect(await engine.store.getIteration(iteration.id)).toBeNull();
+    expect(await engine.store.getDeliverable(deliverable.id)).toBeNull();
+    expect(await engine.store.getAttachment(projectFile.id)).toBeNull();
+  });
+
+  it('clears task references when containers, iterations and deliverables are deleted', async () => {
+    const { engine, project, other } = await setup();
+    const epic = await engine.createContainer({ projectId: project.id, name: 'Epic' });
+    const nested = await engine.createContainer({ projectId: project.id, name: 'Nested', parentId: epic.id });
+    const sprint = await engine.createIteration({ projectId: project.id, name: 'S1', status: 'planning' });
+    const cut = await engine.createDeliverable({ projectId: project.id, title: 'Cut' });
+    await engine.updateTask(other.id, { containerId: epic.id, iterationId: sprint.id, deliverableId: cut.id });
+
+    await engine.deleteContainer(epic.id);
+    await engine.deleteIteration(sprint.id);
+    await engine.deleteDeliverable(cut.id);
+
+    const task = await engine.getTask(other.id);
+    expect(task?.containerId).toBeUndefined();
+    expect(task?.iterationId).toBeUndefined();
+    expect(task?.deliverableId).toBeUndefined();
+    expect((await engine.getContainer(nested.id))?.parentId).toBeUndefined();
+  });
+});
+
+describe('removeDependency', () => {
+  it('removes a dependency, publishes dependency.removed, and requires task.update', async () => {
+    const engine = new CriticalPathEngine({ authorize: createRolePolicy() });
+    const project = await engine.createProject({
+      name: 'Deps',
+      members: [
+        { userId: 'cora', role: 'contributor' },
+        { userId: 'vic', role: 'viewer' }
+      ]
+    });
+    const a = await engine.createTask({ projectId: project.id, title: 'A' });
+    const b = await engine.createTask({ projectId: project.id, title: 'B' });
+    const dependency = await engine.addDependency({ taskId: a.id, dependsOnTaskId: b.id, type: 'blocking' });
+    const events: string[] = [];
+    engine.events.subscribe('dependency.removed', (e) => void events.push(e.name));
+
+    await expect(engine.withActor({ userId: 'vic' }).removeDependency(dependency.id)).rejects.toThrow(ForbiddenError);
+    expect(await engine.withActor({ userId: 'cora' }).removeDependency(dependency.id)).toBe(true);
+    expect(await engine.removeDependency(dependency.id)).toBe(false);
+    expect(events).toEqual(['dependency.removed']);
+  });
+});

package/src/engine/index.ts

@@ -61,6 +61,7 @@ import {
   ProjectCreatedEvent,
   ProjectUpdatedEvent,
   ProjectDeletedEvent,
+  TaskDependencyRemovedEvent,
   WorkflowCreatedEvent,
   WorkflowUpdatedEvent,
   WorkflowDeletedEvent,
@@ -83,7 +84,7 @@ import {
   AttachmentDeletedEvent
 } from '../domain/events.js';
 import { validateAttachmentUrl, AttachmentValidationError } from '../domain/entities.js';
-import { validateCustomFieldValues } from '../domain/custom-fields.js';
+import { validateCustomFieldValues, validateCustomFieldDefinitions } from '../domain/custom-fields.js';
 import { detectDependencyCycle, CircularDependencyError } from '../domain/graph.js';
 import { ValidationError, NotFoundError, ForbiddenError } from '../domain/errors.js';
 import { WebhookDispatcher, assertWebhookUrl } from '../webhooks/dispatcher.js';
@@ -136,9 +137,9 @@ export class CriticalPathEngine {
       }
     }
 
-    if (config.initialData) {
-      this.ready = this.seedInitialData(config.initialData);
-    }
+    this.ready = this.initialize(config);
+    // Callers that never await `ready` should not crash on an unhandled rejection; awaiting it still throws.
+    this.ready.catch(() => {});
   }
 
   /**
@@ -264,6 +265,15 @@ export class CriticalPathEngine {
     return rest as T;
   }
 
+  private async initialize(config: CriticalPathConfig): Promise<void> {
+    if (config.initialData) {
+      await this.seedInitialData(config.initialData);
+    }
+    for (const plugin of this.plugins.getPlugins()) {
+      await plugin.init?.(this);
+    }
+  }
+
   private async seedInitialData(data: NonNullable<CriticalPathConfig['initialData']>): Promise<void> {
     if (data.workflows) {
       for (const wf of data.workflows) {
@@ -442,6 +452,7 @@ export class CriticalPathEngine {
 
   async createProject(project: Omit<Project, 'id' | 'createdAt' | 'updatedAt'>): Promise<Project> {
     await this.requireWorkspaceAccess('project.create');
+    validateCustomFieldDefinitions(project.customFieldDefinitions, this.plugins.getCustomFieldTypes());
     // Views always use the actor's tenant (possibly none); only trusted base-engine calls may set it.
     const input = { ...project, tenantId: this.actor ? this.actor.tenantId : project.tenantId };
     // The creator administers the project they create.
@@ -475,6 +486,7 @@ export class CriticalPathEngine {
     if (!existing) return null;
     await this.requireProjectAccess('project.update', id);
     if ('members' in updates) await this.requireProjectAccess('project.manage_members', id);
+    validateCustomFieldDefinitions(updates.customFieldDefinitions, this.plugins.getCustomFieldTypes());
     updates = this.withoutTenant(updates);
 
     const updated = await this.store.updateProject(id, updates);
@@ -512,12 +524,18 @@ export class CriticalPathEngine {
     const cascade = this.elevated();
 
     const tasks = await this.store.getTasks(id);
-    const deletedTaskIds: string[] = [];
     for (const task of tasks) {
-      if (await cascade.deleteTask(task.id)) {
-        deletedTaskIds.push(task.id);
-      }
+      // Subtasks may already be gone with their parent; deleteTask then returns false.
+      await cascade.deleteTask(task.id);
     }
+    const deletedTaskIds = (
+      await Promise.all(tasks.map(async (t) => ((await this.store.getTask(t.id)) ? null : t.id)))
+    ).filter((taskId): taskId is string => taskId !== null);
+
+    for (const container of await this.store.getContainers(id)) await this.store.deleteContainer(container.id);
+    for (const iteration of await this.store.getIterations(id)) await this.store.deleteIteration(iteration.id);
+    for (const deliverable of await this.store.getDeliverables(id)) await cascade.deleteDeliverable(deliverable.id);
+    for (const attachment of await this.store.getAttachments({ projectId: id })) await cascade.deleteAttachment(attachment.id);
 
     const deleted = await this.store.deleteProject(id);
     if (deleted) {
@@ -561,17 +579,19 @@ export class CriticalPathEngine {
       taskInput = { ...taskInput, reporterId: this.actor.userId };
     }
     const processedInput = await this.plugins.runBeforeTaskCreate(taskInput);
-    const projectId = processedInput.projectId || taskInput.projectId;
+    if (processedInput.projectId && processedInput.projectId !== taskInput.projectId) {
+      throw new ValidationError('Plugins cannot move a task to another project in beforeTaskCreate.');
+    }
+    const projectId = taskInput.projectId;
     const project = await this.store.getProject(projectId);
     const workflow = await this.resolveProjectWorkflow(projectId);
 
-    // Validate custom field domain invariants
-    if (project?.customFieldDefinitions && (processedInput.customFields || taskInput.customFields)) {
-      validateCustomFieldValues(
-        project.customFieldDefinitions,
-        processedInput.customFields || taskInput.customFields
-      );
-    }
+    // Validate custom fields on the final (post-plugin) input, including required fields when none are given
+    validateCustomFieldValues(
+      project?.customFieldDefinitions,
+      processedInput.customFields ?? taskInput.customFields,
+      this.plugins.getCustomFieldTypes()
+    );
 
     const defaultStatus = workflow?.defaultStatusKey || 'todo';
     const initialStatus = processedInput.status || taskInput.status || defaultStatus;
@@ -680,24 +700,32 @@ export class CriticalPathEngine {
     const project = await this.store.getProject(existing.projectId);
     const workflow = await this.resolveProjectWorkflow(existing.projectId);
 
+    // Plugins run first; their output is then validated like caller input. Identity and
+    // ownership fields are never changed by hooks.
+    const {
+      id: _id,
+      projectId: _projectId,
+      createdAt: _createdAt,
+      ...processedUpdates
+    } = await this.plugins.runBeforeTaskUpdate(id, taskUpdates) as Partial<Task>;
+
     // Validate workflow transition invariant
-    if (taskUpdates.status && taskUpdates.status !== existing.status) {
-      const isValid = validateTransition(workflow || undefined, existing.status, taskUpdates.status);
+    if (processedUpdates.status && processedUpdates.status !== existing.status) {
+      const isValid = validateTransition(workflow || undefined, existing.status, processedUpdates.status);
       if (!isValid) {
-        throw new WorkflowValidationError(existing.status, taskUpdates.status, workflow?.id);
+        throw new WorkflowValidationError(existing.status, processedUpdates.status, workflow?.id);
       }
     }
 
     // Validate custom field invariants
-    if (project?.customFieldDefinitions && taskUpdates.customFields) {
-      validateCustomFieldValues(project.customFieldDefinitions, {
-        ...existing.customFields,
-        ...taskUpdates.customFields
-      });
+    if (processedUpdates.customFields) {
+      validateCustomFieldValues(
+        project?.customFieldDefinitions,
+        { ...existing.customFields, ...processedUpdates.customFields },
+        this.plugins.getCustomFieldTypes()
+      );
     }
 
-    const processedUpdates = await this.plugins.runBeforeTaskUpdate(id, taskUpdates);
-
     const now = new Date().toISOString();
     const existingStatusDef = resolveStatusDefinition(
       existing.status,
@@ -1045,16 +1073,22 @@ export class CriticalPathEngine {
     }
   }
 
-  async deleteTask(id: string): Promise<boolean> {
+  /**
+   * Deletes a task and everything that belongs to it: subtasks (or, with `subtasks: 'detach'`,
+   * their parent link), dependencies, comments, attachments (including stored files) and time
+   * entries. The activity log is kept as an audit trail.
+   */
+  async deleteTask(id: string, options: { subtasks?: 'delete' | 'detach' } = {}): Promise<boolean> {
     const existing = await this.getTask(id);
     if (!existing) return false;
     await this.requireProjectAccess('task.delete', existing.projectId);
 
-    await this.plugins.runBeforeTaskDelete(id);
+    await this.plugins.runBeforeTaskDelete(id, existing);
+    await this.deleteTaskChildren(existing, options.subtasks ?? 'delete');
     const deleted = await this.store.deleteTask(id);
 
     if (deleted) {
-      await this.plugins.runAfterTaskDelete(id);
+      await this.plugins.runAfterTaskDelete(id, existing);
       const now = new Date().toISOString();
 
       const event: TaskDeletedEvent = {
@@ -1082,6 +1116,65 @@ export class CriticalPathEngine {
     return deleted;
   }
 
+  /** Removes records owned by a task; the task's deletion was already authorized. */
+  private async deleteTaskChildren(task: Task, subtasks: 'delete' | 'detach'): Promise<void> {
+    const cascade = this.elevated();
+
+    const children = (await this.store.getTasks(task.projectId)).filter((t) => t.parentId === task.id);
+    for (const child of children) {
+      if (subtasks === 'delete') {
+        await cascade.deleteTask(child.id, { subtasks });
+      } else {
+        await this.store.updateTask(child.id, { parentId: undefined });
+      }
+    }
+
+    for (const dependency of await this.store.getDependencies(task.id)) {
+      await cascade.removeDependency(dependency.id);
+    }
+
+    const comments = await this.store.getComments(task.id);
+    const attachments = [
+      ...(await this.store.getAttachments({ taskId: task.id })),
+      ...(await Promise.all(comments.map((c) => this.store.getAttachments({ commentId: c.id })))).flat()
+    ];
+    for (const attachmentId of new Set(attachments.map((a) => a.id))) {
+      await cascade.deleteAttachment(attachmentId);
+    }
+    for (const comment of comments) {
+      await cascade.deleteComment(comment.id);
+    }
+
+    for (const entry of await this.store.getTimeEntries(task.id)) {
+      await this.store.deleteTimeEntry(entry.id);
+    }
+  }
+
+  /** Removes a dependency between two tasks. Requires `task.update` on the dependent task's project. */
+  async removeDependency(id: string): Promise<boolean> {
+    const dependency = await this.store.getDependency(id);
+    if (!dependency) return false;
+    if (this.enforcing) {
+      const task = await this.getTask(dependency.taskId);
+      if (!task) return false;
+      await this.requireProjectAccess('task.update', task.projectId);
+    }
+
+    const removed = await this.store.removeDependency(id);
+    if (removed) {
+      const event: TaskDependencyRemovedEvent = {
+        id: `evt_${Math.random().toString(36).substring(2, 9)}`,
+        name: 'dependency.removed',
+        aggregateId: id,
+        aggregateType: 'Dependency',
+        occurredAt: new Date().toISOString(),
+        payload: { dependency }
+      };
+      await this.events.publish(event);
+    }
+    return removed;
+  }
+
   // --- Task Dependencies & Graph ---
   async addDependency(dep: Omit<TaskDependency, 'id'>): Promise<TaskDependency> {
     if (this.enforcing) {
@@ -1680,13 +1773,29 @@ export class CriticalPathEngine {
     return this.store.updateContainer(id, updates);
   }
 
+  /** Deletes a container. Its tasks and nested containers are kept but no longer reference it. */
   async deleteContainer(id: string): Promise<boolean> {
     const existing = await this.getContainer(id);
     if (!existing) return false;
     await this.requireProjectAccess('plan.manage', existing.projectId);
+    await this.clearTaskReferences(existing.projectId, 'containerId', id);
+    for (const child of (await this.store.getContainers(existing.projectId)).filter((c) => c.parentId === id)) {
+      await this.store.updateContainer(child.id, { parentId: undefined });
+    }
     return this.store.deleteContainer(id);
   }
 
+  /** Unsets a reference (e.g. `iterationId`) on every task in the project that points at `id`. */
+  private async clearTaskReferences(
+    projectId: string,
+    field: 'containerId' | 'iterationId' | 'deliverableId',
+    id: string
+  ): Promise<void> {
+    for (const task of await this.store.getTasks(projectId)) {
+      if (task[field] === id) await this.store.updateTask(task.id, { [field]: undefined });
+    }
+  }
+
   // --- Deliverables ---
   async getDeliverables(projectId: string): Promise<Deliverable[]> {
     if (!(await this.canReadProject(projectId))) return [];
@@ -1703,7 +1812,7 @@ export class CriticalPathEngine {
     await this.requireProjectAccess('plan.manage', input.projectId);
     const project = await this.store.getProject(input.projectId);
     if (project?.customFieldDefinitions && input.customFields) {
-      validateCustomFieldValues(project.customFieldDefinitions, input.customFields);
+      validateCustomFieldValues(project.customFieldDefinitions, input.customFields, this.plugins.getCustomFieldTypes());
     }
 
     const created = await this.store.createDeliverable({
@@ -1786,6 +1895,7 @@ export class CriticalPathEngine {
     const existing = await this.getDeliverable(id);
     if (!existing) return false;
     await this.requireProjectAccess('plan.manage', existing.projectId);
+    await this.clearTaskReferences(existing.projectId, 'deliverableId', id);
 
     const deleted = await this.store.deleteDeliverable(id);
     if (deleted) {
@@ -1920,10 +2030,12 @@ export class CriticalPathEngine {
     return updated;
   }
 
+  /** Deletes an iteration. Its tasks are kept and moved back to the backlog (no iteration). */
   async deleteIteration(id: string): Promise<boolean> {
     const existing = await this.getIteration(id);
     if (!existing) return false;
     await this.requireProjectAccess('plan.manage', existing.projectId);
+    await this.clearTaskReferences(existing.projectId, 'iterationId', id);
     return this.store.deleteIteration(id);
   }
 

package/src/plugins/index.ts

@@ -1,12 +1,31 @@
-import type { CriticalPathPlugin, Task } from '../types/index.js';
+import type { CriticalPathPlugin, CustomFieldType, PluginMiddleware, PluginRoute, Task } from '../types/index.js';
+
+export const BUILT_IN_CUSTOM_FIELD_TYPES = [
+  'text',
+  'number',
+  'date',
+  'boolean',
+  'single_select',
+  'multi_select',
+  'user'
+] as const;
 
 export class PluginRegistry {
   private plugins = new Map<string, CriticalPathPlugin>();
+  private fieldTypes = new Map<string, CustomFieldType>();
 
   register(plugin: CriticalPathPlugin): void {
     if (this.plugins.has(plugin.id)) {
       throw new Error(`Plugin with ID "${plugin.id}" is already registered.`);
     }
+    for (const fieldType of plugin.customFieldTypes ?? []) {
+      if ((BUILT_IN_CUSTOM_FIELD_TYPES as readonly string[]).includes(fieldType.type) || this.fieldTypes.has(fieldType.type)) {
+        throw new Error(`Plugin "${plugin.id}" registers custom field type "${fieldType.type}", which already exists.`);
+      }
+    }
+    for (const fieldType of plugin.customFieldTypes ?? []) {
+      this.fieldTypes.set(fieldType.type, fieldType);
+    }
     this.plugins.set(plugin.id, plugin);
   }
 
@@ -14,6 +33,19 @@ export class PluginRegistry {
     return Array.from(this.plugins.values());
   }
 
+  /** Custom field types contributed by plugins, keyed by `type`. */
+  getCustomFieldTypes(): ReadonlyMap<string, CustomFieldType> {
+    return this.fieldTypes;
+  }
+
+  getRoutes(): Array<PluginRoute & { pluginId: string }> {
+    return this.getPlugins().flatMap((p) => (p.routes ?? []).map((route) => ({ ...route, pluginId: p.id })));
+  }
+
+  getMiddleware(): PluginMiddleware[] {
+    return this.getPlugins().flatMap((p) => (p.middleware ? [p.middleware] : []));
+  }
+
   async runBeforeTaskCreate(task: Partial<Task>): Promise<Partial<Task>> {
     let currentTask = { ...task };
     for (const plugin of this.plugins.values()) {
@@ -25,11 +57,7 @@ export class PluginRegistry {
   }
 
   async runAfterTaskCreate(task: Task): Promise<void> {
-    for (const plugin of this.plugins.values()) {
-      if (plugin.hooks?.afterTaskCreate) {
-        await plugin.hooks.afterTaskCreate(task);
-      }
-    }
+    await this.runAfter('afterTaskCreate', (hooks) => hooks.afterTaskCreate?.(task));
   }
 
   async runBeforeTaskUpdate(id: string, updates: Partial<Task>): Promise<Partial<Task>> {
@@ -43,25 +71,32 @@ export class PluginRegistry {
   }
 
   async runAfterTaskUpdate(task: Task, previousState: Task): Promise<void> {
-    for (const plugin of this.plugins.values()) {
-      if (plugin.hooks?.afterTaskUpdate) {
-        await plugin.hooks.afterTaskUpdate(task, previousState);
-      }
-    }
+    await this.runAfter('afterTaskUpdate', (hooks) => hooks.afterTaskUpdate?.(task, previousState));
   }
 
-  async runBeforeTaskDelete(id: string): Promise<void> {
+  async runBeforeTaskDelete(id: string, task: Task): Promise<void> {
     for (const plugin of this.plugins.values()) {
       if (plugin.hooks?.beforeTaskDelete) {
-        await plugin.hooks.beforeTaskDelete(id);
+        await plugin.hooks.beforeTaskDelete(id, task);
       }
     }
   }
 
-  async runAfterTaskDelete(id: string): Promise<void> {
+  async runAfterTaskDelete(id: string, task: Task): Promise<void> {
+    await this.runAfter('afterTaskDelete', (hooks) => hooks.afterTaskDelete?.(id, task));
+  }
+
+  /** Runs an after-hook on every plugin; the change is already stored, so errors are only logged. */
+  private async runAfter(
+    name: string,
+    call: (hooks: NonNullable<CriticalPathPlugin['hooks']>) => unknown
+  ): Promise<void> {
     for (const plugin of this.plugins.values()) {
-      if (plugin.hooks?.afterTaskDelete) {
-        await plugin.hooks.afterTaskDelete(id);
+      if (!plugin.hooks) continue;
+      try {
+        await call(plugin.hooks);
+      } catch (err) {
+        console.error(`[CriticalPath] Plugin "${plugin.id}" ${name} hook failed:`, err);
       }
     }
   }